Privacy Policy

Who we are

SPM Tech ("we", "us") is an offensive security consultancy based in Vancouver, British Columbia, Canada, providing penetration testing and red team services to clients in Canada and the United States. This policy explains what happens to information collected through spm-tech.co.

For any privacy question, or to exercise the rights described in §06, contact [email protected].

What we collect

We keep this deliberately minimal. This website collects:

We do not sell personal information, we do not run advertising trackers that build profiles for third parties, and we do not ask for sensitive personal data through this website.

Cookies and analytics

We use Google Analytics 4 (measurement ID G-CHJKQJ4Z86), which sets cookies to distinguish visitors and measure how the site is used. IP addresses are handled by Google in accordance with its own terms; we do not use Analytics data to identify individuals.

If we run advertising campaigns, we may use Google Ads measurement to see which campaigns lead to enquiries. This tells us that a click resulted in a contact — it does not tell us who you are.

You can opt out at any time using Google's browser opt-out add-on, by blocking cookies in your browser settings, or by using any standard content blocker. The site works normally with analytics blocked.

Third parties we rely on

• Cloudflare — content delivery, TLS, and protection against abuse. Sees request metadata including IP address.
• Google (Analytics, Fonts, Calendar, and Ads measurement) — usage measurement, web font delivery, and appointment scheduling.
• Google Calendar (appointment scheduling) — the widget used to book calls; anything you type into it is processed by Google.

Each of these processes data under its own privacy policy. We do not pass them client engagement material or any testing data.

Client engagement data

This is separate from website analytics and worth stating plainly, because it is the data our clients actually care about.

Findings, evidence, credentials, and reports produced during a security engagement are governed by the signed agreement and non-disclosure agreement for that engagement — not by this policy. That material is held on encrypted storage, restricted to the operators assigned to the engagement, never used for marketing, never shared with third parties without written instruction, and destroyed or returned on the schedule agreed in the contract. Any case study or sample material we publish is fictional or fully anonymised with the client's written consent.

Your rights

Depending on where you live — including under Canada's PIPEDA, the EU/UK GDPR, and California's CCPA — you may have the right to request access to the personal information we hold about you, ask for it to be corrected or deleted, object to or restrict processing, request a portable copy, and withdraw consent for analytics.

Email [email protected] and we will respond within 30 days. We will never charge you for making a request or treat you differently for exercising these rights.

Retention and security

Analytics data is retained according to our Google Analytics configuration and is automatically deleted after that period. Email correspondence is kept while it is commercially relevant and then deleted. Server and CDN logs are short-lived and used only for reliability and abuse prevention.

The site is served over TLS. We apply the security controls we would expect to find on a client engagement, including strict transport security, content security policy, and restricted permissions policy.

Changes to this policy

If we change how we handle information we will update this page and revise the date at the top. Material changes affecting existing clients will additionally be communicated directly.